Ensure WHERE clause is populated before adding AND

Some defensive coding against the possibility of there being empty `WHERE` clauses which would cause the query to fail.
No need to use `prepare()` for a static string.
Merge pull request #6 from markjaquith/defensive-coding

Defensive coding when constructing WHERE clauses